disable CSRF for now to accept cross-site ajax request from mobile. 
Must reenable it later after proper authentication is added.